ChannelMojo: Ensure that it always has ScopedIPCSupport

ChannelMojo has ScopedIPCSupport, but it is instantiated only in
in-process mode. This CL lets it always instantiate to make it
clear that ChannelInfo is protected by the ScopedIPCSupport.
It simplifies the relationship between the support object and
the channel, and makes the lifecycle invariant reasonable.

With this change, we no longer need to protect ChannelMojo with
ScopedIPCSupport on its client side. Now it's built-in.

Note that this is a speculative fix of fuzzer generated crash,
where Mojo channel related globals are gone before when channel
mojo is being destroyed.

BUG=473438
R=viettrungluu@chromium.org, rockot@chromium.org

Review URL: https://codereview.chromium.org/1054253005

Cr-Commit-Position: refs/heads/master@{#324308}

1 files changed, 3 insertions, 49 deletions

diff --git a/content/child/child_thread_impl.cc b/content/child/child_thread_impl.cc
index 62518ea..eddd157 100644
--- a/content/child/child_thread_impl.cc
+++ b/content/child/child_thread_impl.cc
@@ -56,7 +56,6 @@
 #include "ipc/ipc_sync_channel.h"
 #include "ipc/ipc_sync_message_filter.h"
 #include "ipc/mojo/ipc_channel_mojo.h"
-#include "ipc/mojo/scoped_ipc_support.h"
 
 #if defined(OS_WIN)
 #include "content/common/handle_enumerator_win.h"
@@ -205,45 +204,6 @@ ChildThread* ChildThread::Get() {
   return ChildThreadImpl::current();
 }
 
-// Mojo client channel delegate to be used in single process mode.
-class ChildThreadImpl::SingleProcessChannelDelegate
-    : public IPC::ChannelMojo::Delegate {
- public:
-  explicit SingleProcessChannelDelegate(
-      scoped_refptr<base::SequencedTaskRunner> io_runner)
-      : io_runner_(io_runner), weak_factory_(this) {}
-
-  ~SingleProcessChannelDelegate() override {}
-
-  base::WeakPtr<IPC::ChannelMojo::Delegate> ToWeakPtr() override {
-    return weak_factory_.GetWeakPtr();
-  }
-
-  scoped_refptr<base::TaskRunner> GetIOTaskRunner() override {
-    return io_runner_;
-  }
-
-  void OnChannelCreated(base::WeakPtr<IPC::ChannelMojo> channel) override {}
-
-  void DeleteSoon() {
-    io_runner_->PostTask(
-        FROM_HERE,
-        base::Bind(&base::DeletePointer<SingleProcessChannelDelegate>,
-                   base::Unretained(this)));
-  }
-
- private:
-  scoped_refptr<base::SequencedTaskRunner> io_runner_;
-  base::WeakPtrFactory<IPC::ChannelMojo::Delegate> weak_factory_;
-
-  DISALLOW_COPY_AND_ASSIGN(SingleProcessChannelDelegate);
-};
-
-void ChildThreadImpl::SingleProcessChannelDelegateDeleter::operator()(
-    SingleProcessChannelDelegate* delegate) const {
-  delegate->DeleteSoon();
-}
-
 ChildThreadImpl::Options::Options()
     : channel_name(base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
           switches::kProcessChannelID)),
@@ -321,15 +281,9 @@ void ChildThreadImpl::ConnectChannel(bool use_mojo_channel) {
     VLOG(1) << "Mojo is enabled on child";
     scoped_refptr<base::SequencedTaskRunner> io_task_runner = GetIOTaskRunner();
     DCHECK(io_task_runner);
-    if (IsInBrowserProcess())
-      single_process_channel_delegate_.reset(
-          new SingleProcessChannelDelegate(io_task_runner));
-    ipc_support_.reset(new IPC::ScopedIPCSupport(io_task_runner));
-    channel_->Init(
-        IPC::ChannelMojo::CreateClientFactory(
-            single_process_channel_delegate_.get(),
-            channel_name_),
-        create_pipe_now);
+    channel_->Init(IPC::ChannelMojo::CreateClientFactory(
+                       nullptr, io_task_runner, channel_name_),
+                   create_pipe_now);
     return;
   }